Production of transcripts of an employee's private conversations as evidence of abuse of a company's internet at work policy is not necessarily a violation of the employee's right to private life

Spotlight
15 March 2016

In a judgment of 12 January 2016 (Barbulescu vs. Romania), the European Court of Human Rights answered the question whether monitoring of an employee's communications via instant messaging is a violation of Article 8 ECHR. This judgment shows the delicate balance of interests that has to be struck between the employer's right to monitor and the employee's right to protection of private life when monitoring the use of online communication tools during working hours.

Facts

On 1 August 2007 a Romanian employer in the private sector fired one of its employees. It had been shown that the employee in question had violated the company's policy on internet use by using a Yahoo Messenger account, created at the employer's request to provide customer information, for personal purposes during working hours. The employee initially claimed that he had only used the account for professional purposes, but he was soon faced with a 45-page transcript of personal conversations with his brother and his fiancée. Shortly afterwards, the employee was dismissed because the transcripts showed that the employee had breached the company's internet at work policy.

Because he considered that his dismissal was based on a violation of his right to private communication and to private life and was therefore invalid, the employee challenged his dismissal before local courts in Romania.

However, the employee's claim was rejected: the Romanian courts ruled that an employer has the right to monitor the internet use of employees. Moreover, the Romanian courts found that the employee was adequately informed through the company policy about the ban on private use of the internet at work.

Judgment of the European Court of Human Rights of 12 January 2016

The employee's appeal to the European Court of Human Rights asserting that the monitoring of the Yahoo Messenger account constituted a violation of Article 8 of the ECHR was also unsuccessful.

In its judgment of 12 January 2016, the Court held that the monitoring of the employee's conversations on a Yahoo Messenger account did not result in a violation of Article 8 of the ECHR in this case.

In its judgment, the Court took into account three elements in particular:

The Court first notes that in this case the employer had monitored the employee's use of the internet following the employee's assertion that he had used it purely for professional matters. Under Romanian law, employers can monitor professional activities. Therefore, according to the Court, the employer acted within its disciplinary powers.

The Court further maintains that the Romanian courts did not attach decisive importance to the contents of the transcript. The transcripts of the personal conversations were merely provided as evidence of the fact that the Yahoo Messenger account had been used for personal purposes and, hence, to establish the disciplinary breach by the employee without taking into account the contents of the conversations.

Finally, the Court considers that the fact that the employer did not suffer any damage is irrelevant, because it is not unreasonable for an employer to verify whether its employees are performing their professional duties during working hours.

The importance of this decision for your company

This decision once again shows the importance of having a clear written company policy that is sufficiently known within the company in relation to monitoring the use of corporate resources during working hours and cybermonitoring, in particular with regard to the use of company computers, web surfing, e-mail, instant messaging, BYOD, etc.

The Belgian rules on this matter can be found in CLA no. 81 of 26 April 2002 regarding protection of the privacy of employees in relation to the monitoring of electronic online communications, and they should always be implemented with due regard to the Act of 8 December 1992 on the protection of personal data.